CVE-2025-20758: MediaTek NR15 DoS Vulnerability

CVE-2025-20758 Overview

CVE-2025-20758 is a denial of service vulnerability in MediaTek modem firmware. An uncaught exception in the modem stack can trigger a system crash when a User Equipment (UE) device connects to a rogue base station controlled by an attacker. The flaw affects a broad range of MediaTek chipsets used in smartphones, tablets, and IoT devices. MediaTek published the issue in its December 2025 Product Security Bulletin under Patch ID MOLY01673755 and Issue ID MSV-4647. The vulnerability is classified as [CWE-248] Uncaught Exception. Exploitation requires no user interaction and no additional execution privileges on the device.

Critical Impact
An attacker operating a rogue base station can remotely crash the modem of a connected device, disrupting cellular connectivity until the modem restarts.

Affected Products

MediaTek 5G modems: NR15, NR16, NR17, NR17R
MediaTek Dimensity and Helio SoCs including MT6833, MT6877, MT6893, MT6983, MT6989, MT6991
MediaTek automotive and tablet SoCs including MT2735, MT8755, MT8798, MT8893

Discovery Timeline

2025-12-02 - CVE-2025-20758 published to NVD
2025-12-02 - MediaTek December 2025 Product Security Bulletin released
2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-20758

Vulnerability Analysis

The vulnerability resides in the MediaTek modem firmware that handles cellular protocol signaling. When the modem receives certain malformed or unexpected messages from a base station, an exception path is not handled by the firmware. The unhandled exception causes the modem subsystem to crash, breaking radio connectivity on the affected device.

The attack model relies on a rogue base station. An attacker must operate radio equipment that the target UE attaches to, typically by broadcasting with stronger signal characteristics than legitimate cells. Once the UE camps on the rogue cell, the attacker sends crafted signaling that triggers the exception. The CVSS vector indicates a network-adjacent radio attack with no user interaction and high impact to availability only. Confidentiality and integrity are not affected.

Root Cause

The root cause is improper exception handling within the baseband modem code, mapped to [CWE-248] Uncaught Exception. A code path processes attacker-influenced input from over-the-air signaling without catching all possible exceptions, causing the modem task to terminate abnormally.

Attack Vector

Exploitation requires the attacker to control a base station that the target device attaches to. This can be achieved with software-defined radio platforms and open-source cellular stack implementations capable of impersonating a legitimate carrier cell. Once a UE attaches, the attacker transmits the triggering signaling message. The result is a denial of service condition on the device modem. The MediaTek advisory does not publish exploitation details or proof-of-concept code, and no public exploit is available.

Detection Methods for CVE-2025-20758

Indicators of Compromise

Repeated modem crashes, radio link resets, or loss of cellular service on MediaTek-based devices in a localized area
Unexpected attach attempts to unknown PLMN identifiers or cells with anomalous parameters
Device modem crash logs referencing the modem task termination on affected chipsets

Detection Strategies

Monitor mobile device management (MDM) and endpoint telemetry for elevated rates of modem reboots or baseband resets
Correlate cellular outages across multiple devices in a geographic location to identify potential rogue base station activity
Where available, collect modem crash dumps from fleet devices and review for patterns aligning with MOLY01673755

Monitoring Recommendations

Track patch level reporting from device vendors to confirm MediaTek December 2025 fixes are deployed
Alert on devices that fail to receive vendor security updates within an acceptable window
For high-risk users, monitor for signs of IMSI catcher activity such as forced 2G downgrade or unauthenticated cell attachment

How to Mitigate CVE-2025-20758

Immediate Actions Required

Inventory devices using affected MediaTek chipsets and identify those pending firmware updates
Coordinate with device OEMs and mobile carriers to obtain firmware images that include the MediaTek December 2025 patch
Prioritize updates for executives, field staff, and other users likely to operate in untrusted radio environments

Patch Information

MediaTek addressed the issue in the December 2025 Product Security Bulletin. The fix is identified by Patch ID MOLY01673755 and Issue ID MSV-4647. Device manufacturers must integrate the updated modem firmware into their security maintenance releases. See the MediaTek Security Bulletin December 2025 for the authoritative list of affected chipsets and remediation references.

Workarounds

Restrict device usage in high-risk locations until vendor firmware updates are applied
Where supported, disable legacy 2G/3G fallback to reduce the rogue base station attack surface
Use enterprise mobility controls to enforce minimum patch levels on managed devices

bash

# Verify Android build security patch level on managed devices
adb shell getprop ro.build.version.security_patch
# Confirm the reported level reflects the December 2025 MediaTek bulletin or later